https://github.com/osquery/osquery logo
Join Slack
Powered by
Hi :wave: Does anybody know if there's a way to c...
# macos
t
Hi šŸ‘‹ Does anybody know if there's a way to check if a MacOS laptop without MDM has screenlock active? I tried the following: 1. Works ONLY for MDM managed devices:
Copy code
SELECT
    CASE
      WHEN EXISTS (
        -- Check MDM-managed screensaver timeout
        SELECT 1 FROM managed_policies
        WHERE domain = 'com.apple.screensaver'
        AND name = 'idleTime'
        AND CAST(value AS INTEGER) > 0
      ) THEN 1
      -- Can't detect user-configured screen lock from root
      ELSE NULL  -- Return NULL instead of 0 to indicate "unknown"
    END AS screenlock_status;
2. Tried querying screenlock table, but seems like osqueryi can run it with user permission, but osqueryd cannot run it from a schedule with root permissions. I need the query to detect the screenlock setting when ran by osqueryd when it fetches the configured schedule. Loosing hope a bit. Any idea is welcome! Thank you šŸ™
Currently disabling the following tables:
Copy code
keychain_items,keychain_acls,mdfind,curl,user_ssh_keys,browser_plugins,safari_extensions,chrome_extensions,firefox_addons,user_interaction_events,process_envs,es_process_events,authorization_mechanisms,authorizations,wifi_networks,location_services,certificates,logged_in_users,users,ssh_configs
Claude insists:
There's no osquery flag that can fix this. The issue is at the macOS OS level, not osquery configuration.
I've checked all relevant flags:
- --allow_unsafe=true - Only affects executable permissions
- --disable_audit=false - For audit subsystem
- --force=true - For forcing operations
- --enable_file_events=true - For file monitoring
- No flag exists to "read user preferences as root"
The screenlock table's inability to read user preferences when running as root is hardcoded behavior in macOS, not configurable via osquery flags.
Your only options are:
1. Use MDM to enforce screen lock settings (readable by root)
2. Modify the query to return NULL instead of 0 for unknown status:
SELECT CASE
WHEN EXISTS (SELECT 1 FROM managed_policies WHERE domain = 'com.apple.screensaver')
THEN (SELECT enabled FROM screenlock)
ELSE NULL
END AS screenlock_status;
3. Document the limitation that Fleet can only verify MDM-enforced screen locks
There's simply no flag to bypass macOS's security model that prevents root from reading user security preferences.
But I'm not convinced...
a
What does screenlock mean, you mean after being idle power saving/screensaver will kick in, and it will require a password to wake?
āœ… 1
t
correct
f
@Toni Sanmateu, we had to navigate this when building Kolide's screenlock check: https://www.kolide.com/blog/how-kolide-built-its-macos-screenlock-check#getting-meta-osquery-running-osquery
If you are using Kolide's launcher you can query this table today from a root context: 
kolide_screenlock
Copy code
osquery> SELECT * FROM kolide_screenlock WHERE user = 'fritz';
+---------+--------------+-------+
| enabled | grace_period | user  |
+---------+--------------+-------+
| 1       | 0            | fritz |
+---------+--------------+-------+
t
We're using fleet unfortunately šŸ˜ž Is there a raw osquery solution?
Will look into the article as soon as I can, thanks @fritz
Btw @fritz is this only an issue on macOS?
f
There is no raw osquery solution to the best of my knowledge. You need to be able to instantiate an osquery shell using that 
launchctl asuser
command in order to retrieve user context while running the agent as root.
Btw @fritz is this only an issue on macOS?
The methods for determining screenlock status are different on Windows and Linux and have their own difficulties to navigate. We also use extended (non vanilla osquery) tables to evaluate screenlock on those platforms.
For example, reconciling the configuration of screenlock on Windows requires looking at: ā€¢ AC/Battery power plan settings for display and device sleep ā€¢ Screensaver settings ā€¢ Modern Standby settings ā€¢ Whether a password is required on wake ā€¢ GPO Policies which can override the above settings
šŸ‘€ 1
t
I see. Thanks a lot for the ellaborate response šŸ™ Combined with what the fleet team mentioned in another thread, I see how this becomes increasingly complex without relying on MDMs
f
It can definitely be done without MDM (we have tons of orgs that enforce these settings via our Device Trust offering, but do not manage the settings directly via their MDM), but the queries themselves are not "easy" to write, and they definitely necessitate extension of the osquery agent to accurately detect.
t
How feasible do you think it is to build these extensions from scratch? Problem is I built an installer customisation pipeline based on fleetctl and a backend integration on my company's backend for the osqueryd agents. It wouldn't be possible to switch to Kolide at this point... I did it this way because they wanted to go open source all the way, now I see I would've been better off with Launcher than Orbit.
In the fleet channel they mentioned that it shouldn't work for Kolide either without an MDM granting macos with FDA
f
While it is true that certain queries may require FDA in order to return results, to the best of my knowledge the screenlock query is not one of these.
šŸ¤” 1
šŸ™Œ 1
t
So this is essentially an osquery extension right? Do you have any recommendation if I cannot switch to Launcher and need to build this one myself?
Well done btw
f
That article originally was published in July of 2020, with some small updates added in 2022.
āœ… 1
Unfortunately, outside of being a Kolide customer we wouldn't be able to support you in using the existing Kolide Launcher implementation of the table (
kolide_screenlock
). You could look at figuring out the 
launchctl asuser
instantiation of osquery yourself using something like osquery-go, but I apologize, I wouldn't be able to help you much further.
šŸ™ 1
t
No worries šŸ™‚ Thanks @fritz
ā¤ļø 1
s
Do note that much of the launcher code base has an enterprise license attached to it.
t
What do you mean @seph that the screenlock table is a paid feature?
s
Read the license.
t
It reads as you mean that, asking for clarification
s
What clarification are you looking for?
t
Do note that much of the launcher code base has an enterprise license attached to it.
You brought this comment into a context, which seems to imply you said it because that feature is not free. So I ask you to clarify, otherwise I don't get the comment.
s
Osquery is a volunteer project maintained by several community members. There are additionally several companies that have products based around it. Fleet and Kolide are two companies, though there's some shared history. This is the osquery slack. it's a great place to talk about osquery, and you may find staff or support people for vendors you use. But this is generally not a formal support channel.
The Kolide Agent, known as launcher, which is the source of the discussion here, has an enterprise license attached. It seems quite appropriate to the context.
šŸ‘ 1
t
Alright, thank you
My question turned around osquery, initially. And the issue of checking the screenlock. What's the appropriate community support channel for that?
s
Here's fine. Fritz answered it quite clearly.
t
Alright nevermind, I think we are not understanding each other.
Thanks
78 Views
Open in Slack
PreviousNext
Powered by